Who's Attacking the Server?
Someone is trying to guess passwords on the server. The login log, /var/log/auth.log, records every attempt, like this:
Jun 2 03:14:07 vulntech sshd[2048]: Failed password for root from 203.0.113.77 port 51234 ssh2
Jun 2 03:14:09 vulntech sshd[2049]: Failed password for invalid user test from 198.51.100.4 port 40022 ssh2
Jun 2 03:20:41 vulntech sshd[2101]: Accepted password for alice from 192.168.1.10 port 50122 ssh2Find out who is attacking, and whether anyone got in. Tip: counting fields from the end works for both kinds of Failed line: the IP address is always $(NF-3) in awk, and the user name $(NF-5).
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Hints
Work on the Failed lines only: start every pipeline with grep 'Failed password' /var/log/auth.log.
Solution explanation
Every answer comes from one pipeline: grep keeps the failed attempts, awk picks the IP ($(NF-3)) or the user ($(NF-5)), and sort | uniq -c | sort -rn ranks them. sort -u makes the blocklist. Finally, grep -f blocklist.txt uses the blocklist as a list of patterns: the only Accepted line from an attacker shows that deploy was broken into. Time to change that password!
Show solution
grep -c 'Failed password' /var/log/auth.log
grep 'Failed password' /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -rn | head -n 3
grep 'Failed password' /var/log/auth.log | awk '{print $(NF-3)}' | sort -u | wc -l
grep 'Failed password' /var/log/auth.log | awk '{print $(NF-5)}' | sort | uniq -c | sort -rn | head -n 3
grep 'Failed password' /var/log/auth.log | awk '{print $(NF-3)}' | sort -u > blocklist.txt
grep Accepted /var/log/auth.log | grep -f blocklist.txt